Allaire Security Bulletin (ASB00-22) - The Cerberus Security Team has released an advisory about a security issue in the O'Reilly Website Pro web server. The issue could allow a malicious user to execute arbitrary code. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers see O'Reilly's support options for further information about this issue.
2e4dba4b3e3601fabfdae51279f4c30ef7e87c6037ef6c8e010dc33bac2435b9The Cerberus Security Team has released an advisory about a security issue in the O'Reilly Website Pro web server. The issue could allow a malicious user to execute arbitrary code. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers see O'Reilly's support options for further information about this issue.
30697db1811fa4cbf55ba5b89a7168185e239ed8e5c867a77d2f19ea38b70850Allaire Security Bulletin (ASB00-20) - Microsoft has released a patch for two security vulnerabilities in Microsoft Internet Information Server. In sum, the vulnerabilities could allow a malicious user to stop the web server from providing useful service, or to extract certain types of information from it. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.
c452c9f99992333457e1fa65b182fed52baf14b3311afbe5bb5d098e78289dbcAllaire Security Bulletin (ASB00-16) - Microsoft has released a patch for a security vulnerability in Microsoft SQL Server 7.0. The vulnerability could allow a malicious user to run a database stored procedure without proper permissions. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users.
c09e5fa63dd1b5c76a1b94a54a56022ab41e099dbb5740045e1926ea083d38b7Allaire Security Bulletin (ASB00-17) - Microsoft has released an updated patch that eliminates a security vulnerability in Microsoft(r) SQL Server 7.0. The vulnerability could allow a malicious user to compromise passwords. The updated patch also addresses a related problem with the Enterprise Manager Server registration dialog. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users.
45bdfbf288ce1e1b06c8bbe8ccaaebc5b0132ebd6d4186bd64a18981ea7c1281Allaire Security Bulletin (ASB00-15) - JRun 2.3.x includes a number of example applications and sample code that expose security issues. JRun 3.0 addresses the viewsource.jsp issue. Allaire strongly recommends that customers follow the best practice of not installing sample code and documentation on production servers, and removing the sample code and documentation files from production servers and restricting access to those directories where they are installed on workstations.
583cfb90648a70c3c326d209d85aa4bf0da94b52d4569f3b24edec6c712872d5Allaire Security Bulletin (ASB00-14) - Allaire has recently been notified by Foundstone, Inc. (see Revisions section below for contact information) of a denial of service attack against an unprotected installation of the ColdFusion Administrator. This issue only affects ColdFusion Servers that have not followed Allaire's recommendations in the Allaire Security Best Practices article 10954.
5f15d73015593185e82770c379eda7d3e8ca9790e0e0bf36811eca22b5c1d3c0Allaire Security Bulletin (ASB00-13) - Microsoft has released a patch for two security vulnerabilities in Microsoft(r) Internet Information Server. The vulnerabilities could, respectively, be used to slow an affected web server's response or to obtain the source code of certain types of files under very restricted conditions. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.
1a58b773376c9c2c01005a1c0f9ed18b8211ed7b50a242a2cdbfafac6a359160Allaire Security Bulletin (ASB00-11) - A procedure is available to eliminate a security vulnerability affecting several web server products. The vulnerability could potentially allow a malicious web site visitor to perform actions that the system permissions authorize him to perform, but which he previously may have had no means of actually carrying out. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.
ead49691ad21715e0cc247f3d78fe35d2479b62c76bd26d3dc1a257cf8f8a048Allaire Security Bulletin (ASB00-08) - Microsoft has announced a Microsoft has released a patch for a security vulnerability in Microsoft(r) Internet Information Server. The vulnerability could allow a malicious user to slow a web server's response or prevent it from providing service altogether for a period of time. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.
ac68120bd491e52080e26865af69543e2ae53539643caf20528904d3ab4b9ff1Allaire Security Bulletin (ASB00-09) - Microsoft has released a procedure to eliminate a security vulnerability that could allow a malicious user to cause a web server to crash, or potentially run arbitrary code on the server, if certain permissions have been changed from their default settings to inappropriate ones. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users. Allaire recommends that customers follow the instructions posted on the Microsoft Web site to address this issue.
d37d4eb5c51ea92c8c1526fd4f6f594f3d5a6e1b0bfd388cd9f32bae85d8ff8fAllaire Security Bulletin (ASB00-10) - The Spectra Container Editor Preview does not properly enforce object security. Allaire has released a patch that addresses this issue.
8c3ae5d3c258a942638f700431baed582c7de0cf50aa4faf2bea5f4cf43d2183Allaire Security Bulletin (ASB00-07) - Microsoft has announced a vulnerability for Microsoft IIS which exposes the ability to use a malformed URL to read the source code of ASP, CFML, Perl and other files that are on a server. This is not a problem with ColdFusion Server itself, but it is an issue that can affect ColdFusion users.
a99ac1f1b065bd3b464ae979a2a401ccafdec0ed9a2a4b083c4b2d1f97479f6eAllaire Security Bulletin (ASB00-06) - Allaire has recently been notified of a security issue in the Allaire Forums 2.0.5 software. This behavior allows users to view and post to secure discussion threads via unsecured conferences and/or through email. This issue affects multiple templates in the Forums software. Updated versions of the affected templates are available from the following link: Download - Allaire Forums 2.0.5 Security Patch.
e1d1c4b8932ac01a330c6dd52f48934c9fe51519f19c1eadeba06ac77c0b4e3dasb99-11.mdac_rds
9c9619f4c80bf857b50c70083d86e66e4c1408e0c9d7c3fe4194016e2e3299d6Allaire Security Bulletin (ASB00-05) - A new type of security attack called "cross-site scripting" has surfaced which is based on common website design flaws and data manipulation that web browsers use when communicating with web servers. While the problem is not a vendor-specific issue, it does affect many web servers and virtually all web browsers currently in use. The problem lies with the design and coding techniques of web sites that serve dynamically generated HTML pages rather than the software the websites themselves run on.
263a7b7349d0ec73c6d43988d37ac87c2bab3e0a66c8fe0f3ebcca768485fbdbAllaire Security Bulletin (ASB00-04) - There is a security issue with the Spectra 1.0 Remote Access Service invoke.cfm template. Normally users must be authenticated in the webtop security context in order to even attempt to use the Remote Access Service. However, if the user passes a parameter called "bAuthenticated" via the URL, a form field, or a WDDX packet, and the user does not specify a username, a bug allows them to use the Remote Access Service even if they are not in the webtop user directory.
2290cf21532b82df7407b2f96d6ef361b638bc62542d8deed22068dd7b082343Allaire Security Bulletin (ASB00-01) - The Allaire Spectra 1.0 Webtop allows authenticated users to access sections of the Webtop they may not have been granted access to by typing explicit URLs. This exploit does not give anyone access to the Webtop who does not already have permissions to at least one section of the Webtop.
89cd666fa3246d4f7ebefb76dbcea8fd8a1db1e06be3006a22c41234f8219a83Allaire Security Bulletin (ASB00-02) - When installing Allaire Spectra 1.0, a web-based Configuration Wizard is used to finalize a number of configuration settings, including a step which indexes data collections on the server. This step of the Configuration Wizard can be accessed via URL and the collections can be resubmitted for indexing. This could be used in a denial of service attack on an Allaire Spectra server.
dfc853cd876112922ef7e7ffa98959fb45ca4072eedf2687afe1167c88734cbaAllaire Security Bulletin (ASB00-03) - Patch Available For Potential Information Exposure by the CFCACHE Tag. The CFCACHE tag is a feature available in ColdFusion 4.x to perform template caching to increase page delivery performance by intelligently compiling and storing the output of CFML pages for faster access. When this tag is utilized in a .CFM page it creates several temporary files, including one that contains absolute filenames with directory path information, URL parameters and timestamps. In ColdFusion 4.0x, these files are stored in the same directory as the .CFM page, usually in a publicly accessible web document directory.
75b3ad2d7dbcd77486fa642c8fd4d91440c50797cfaa6cd24391e43892942199Allaire Security Bulletin (ASB00-12) - ClusterCATS Appends Stale Query String to URL Line during HTML Redirection. The vulnerability potentially releases confidential query string information on redirect. Affected software versions include ClusterCATS ColdFusion.
bc4b4c2f53dde1501082ca668ae4f331c22b091b418fc72ae56691b0a54495a4asb99-01.expression_evaluator
ca6018ad1790f79ad7ac3c9d99ae04577fe614ac5bf49bc8d222b8d203351d96asb99-02.coldfusion_example_apps
6dc85f5e6735909fad69b69c3d1e23a59edc883a5135260c057dce50792ec6eeasb99-03.miis_DATA
7bfb40d64d5880629df367901eeb17f4b2ebb55e99bde64f01246b0290374db4asb99-04.mult_sql_statements
6cce80316a8e293634d03ad433a3633bb79a240f5cb143ae3e8085484c66d8eb
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed